CVE Feed

    Dashboard / CVE / CVE-2007-3846

    CVE-2007-3846

    Directory traversal vulnerability in Subversion before 1.4.5, as used by TortoiseSVN before 1.4.5 and possibly other products, when run on Windows-based systems, allows remote authenticated users to overwrite and create arbitrary files via a ..\ (dot dot backslash) sequence in the filename, as stored in the file repository.

    Published:Aug 28, 2007
    Last Modified:Apr 23, 2026
    EPS:Aug 28, 2007
    EPSS Score:0.01282
    CVSS Score:6

    Affected Products

    Vendor
    Subversion
    Product
    Subversion
    Vendor
    Tortoisesvn
    Product
    Tortoisesvn

    Exploits

    No exploit reference

    Related CVEs

    CVE-2009-2411 (CVSS 8.5) — Multiple integer overflows in the libsvn_delta library in Subversion before 1.5.7, and 1.6.x before 1.6.4, all…
    CVE-2007-2448 (CVSS 2.1) — Subversion 1.4.3 and earlier does not properly implement the "partial access" privilege for users who have acc…
    CVE-2004-1438 (CVSS 2.1) — The mod_authz_svn Apache module for Subversion 1.0.4-r1 and earlier allows remote authenticated users, with wr…
    CVE-2004-0749 (CVSS 5) — The mod_authz_svn module in Subversion 1.0.7 and earlier does not properly restrict access to all metadata on …
    CVE-2004-0413 (CVSS 10) — libsvn_ra_svn in Subversion 1.0.4 trusts the length field of (1) svn://, (2) svn+ssh://, and (3) other svn pro…
    CVE-2004-0397 (CVSS 7.5) — Stack-based buffer overflow during the apr_time_t data conversion in Subversion 1.0.2 and earlier allows remot…

    References

    http://crisp.cs.du.edu/?q=node/36
    http://osvdb.org/40118
    http://osvdb.org/40119
    http://secunia.com/advisories/26625
    http://secunia.com/advisories/26632
    http://securitytracker.com/id?1018617
    http://subversion.tigris.org/servlets/NewsItemView?newsItemID=1941
    http://subversion.tigris.org/servlets/ReadMsg?list=users&msgNo=69413
    http://subversion.tigris.org/servlets/ReadMsg?list=users&msgNo=69413
    http://subversion.tigris.org/servlets/ReadMsg?list=users&msgNo=69413
    http://subversion.tigris.org/servlets/ReadMsg?list=users&msgNo=69413
    http://tortoisesvn.net/node/291
    http://www.securityfocus.com/bid/25468
    http://www.vupen.com/english/advisories/2007/3003
    http://www.vupen.com/english/advisories/2007/3004
    https://exchange.xforce.ibmcloud.com/vulnerabilities/36312
    http://crisp.cs.du.edu/?q=node/36
    http://osvdb.org/40118
    http://osvdb.org/40119
    http://secunia.com/advisories/26625
    http://secunia.com/advisories/26632
    http://securitytracker.com/id?1018617
    http://subversion.tigris.org/servlets/NewsItemView?newsItemID=1941
    http://subversion.tigris.org/servlets/ReadMsg?list=users&msgNo=69413
    http://subversion.tigris.org/servlets/ReadMsg?list=users&msgNo=69413
    http://subversion.tigris.org/servlets/ReadMsg?list=users&msgNo=69413
    http://subversion.tigris.org/servlets/ReadMsg?list=users&msgNo=69413
    http://tortoisesvn.net/node/291
    http://www.securityfocus.com/bid/25468
    http://www.vupen.com/english/advisories/2007/3003
    http://www.vupen.com/english/advisories/2007/3004
    https://exchange.xforce.ibmcloud.com/vulnerabilities/36312

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High